{
  pkgs,
  lib,
  config,
  nodeName,
  repoFlake,
  ...
}: let
  passwords = import ../../../variables/passwords.crypt.nix;

  localTcpPorts = [
    22

    # syncthing
    22000

    # iperf3
    5201
  ];

  localUdpPorts = [
    # syncthing
    22000
    21027
  ];

in {
  imports = [
    ../../snippets/nix-settings-holo-chain.nix
  ];

  nix.settings = {
    substituters = [
    ];
    trusted-public-keys = [
    ];
  };

  nix.distributedBuilds = true;
  nix.buildMachines = [
    {
      hostName = repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost;
      # TODO: make this a reference
      sshUser = "nix-remote-builder";
      protocol = "ssh-ng";
      system = "x86_64-linux";
      maxJobs = 24;
      speedFactor = 100;
      supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [];
    }
  ];

  networking.extraHosts = ''
  '';

  networking.bridges."virbr1".interfaces = [];
  networking.interfaces."virbr1".ipv4.addresses = [
    {
      address = "10.254.254.254";
      prefixLength = 24;
    }
  ];

  # needed to make wireguard managed by networkmanager route all traffic through it
  networking.firewall.checkReversePath = false;

  networking.firewall.enable = true;
  services.openssh.openFirewall = false;

  # TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
  networking.firewall.interfaces."eth+".allowedTCPPorts = localTcpPorts;
  networking.firewall.interfaces."eth+".allowedUDPPorts = localUdpPorts;
  networking.firewall.interfaces."wlan+".allowedTCPPorts = localTcpPorts;
  networking.firewall.interfaces."wlan+".allowedUDPPorts = localUdpPorts;

  networking.firewall.logRefusedConnections = false;
  networking.usePredictableInterfaceNames = false;

  services.fwupd.enable = true;

  services.fprintd.enable = true;
  security.pam.services = {
    login.fprintAuth = true;
    sudo.fprintAuth = true;
  };

  # virtualization
  virtualisation = {
    libvirtd = {enable = true;};

    virtualbox.host = {
      enable = false;
      addNetworkInterface = false;
    };

    podman = {
      enable = true;
      dockerCompat = true;
      # defaultNetwork.dnsname.enable = true;
    };
  };

  services.samba.extraConfig = ''
    # client min protocol = NT1
  '';
  services.gvfs = {
    enable = true;
    package = lib.mkForce pkgs.gnome3.gvfs;
  };
  environment.systemPackages = with pkgs; [lxqt.lxqt-policykit]; # provides a default authentification client for policykit

  security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];

  services.xserver.videoDrivers = lib.mkForce ["amdgpu"];
  services.xserver.serverFlagsSection = ''
    Option "BlankTime" "0"
    Option "StandbyTime" "0"
    Option "SuspendTime" "0"
    Option "OffTime" "0"
  '';

  time.timeZone = lib.mkForce passwords.timeZone.stefan;

  hardware.ledger.enable = true;

  services.zerotierone = {
    enable = true;
    joinNetworks = [
      # moved to the service below as it's now secret
    ];
  };

  systemd.services.zerotieroneSecretNetworks = {
    enable = false;
    requiredBy = ["zerotierone.service"];
    partOf = ["zerotierone.service"];

    serviceConfig.Type = "oneshot";
    serviceConfig.RemainAfterExit = true;

    script = let
      secret = config.sops.secrets.zerotieroneNetworks;
    in ''
      # include the secret's hash to trigger a restart on change
      # ${builtins.hashString "sha256" (builtins.toJSON secret)}

      ${config.systemd.services.zerotierone.preStart}

      rm -rf /var/lib/zerotier-one/networks.d/*.conf
      for network in `grep -v '#' ${secret.path}`; do
        touch /var/lib/zerotier-one/networks.d/''${network}.conf
      done
    '';
  };

  sops.secrets.zerotieroneNetworks = {
    sopsFile = ../../../../secrets/zerotierone.txt;
    format = "binary";
  };

  boot.binfmt.emulatedSystems = [
    "aarch64-linux"
  ];
}